0

I have a key for a one-time pad. Its length is 512, and I have a message to encrypt whose length is 600. Can I reuse the first 88 chars of the key to encrypt the end of the message?

The key is still random, so it should be still secure, right? If it isn't secure, why not?

Patriot
  • 3,162
  • 3
  • 20
  • 66
crak
  • 1

1 Answers1

4

Re-using the key of a one time pad in a cycle makes your cipher a Vigenère cipher - it is no longer a one time pad.

This scheme is weak for lots of reasons. The easiest example is with known plaintext. Let's pretend your scheme is used to encrypt packet data. Chances are, the first 20 bytes are known or easy to guess packet header bytes so we have:

$ \text{KnownBytes} \oplus k_{1-20} \mathbin\Vert \text{Something} \oplus k_{21-512} \mathbin\Vert \text{Bytes1} \oplus k_{1-20} \mathbin\Vert \text{Bytes2} \oplus k_{21-88} $

where $k$ is the key

Given this, we can recover the value $\text{Bytes1}$ simply by $\text{KnownBytes} \oplus k_{1-20} \oplus \text{Bytes1} \oplus k_{1-20} = \text{KnownBytes} \oplus \text{Bytes1}$. Since you know $\text{KnownBytes}$ you can then compute $\text{Bytes1}$.

It gets worse. You've also reused key bytes 21 through 88. Just because the attacker doesn't know the value of $\text{Bytes2}$ or the first few bytes of $\text{Something}$ doesn't make it secure. The two ciphertexts can be xored to remove the key and yield the xor of the underlying plaintext.

Thomas M. DuBuisson
  • 1,894
  • 15
  • 20